Skip to main content
Connect Vercel to let CloudThinker agents find out why a deployment failed, read runtime logs, check which deployment is live, and audit domains, plus cancel a deployment or pause a project through your Approvals. The connection uses one Vercel access token, and the token’s scope (your personal account or one team) decides what agents can see.

​
Prerequisites

  • A Vercel account that can see the team and projects you want to investigate.
  • Permission to create access tokens for that team.
  • The Admin role in the CloudThinker workspace, which you need to add connections. See Roles.

​
Setup

1

Create an access token in Vercel

In Vercel, open the avatar menu and go to Account Settings → Tokens (direct link). Create a token:
  • Name: cloudthinker
  • Scope: the one team CloudThinker should reach, or your personal account. A token reaches only that scope, so if your projects span several teams, create one token per team and add each as its own connection.
  • Expiration: pick a date and put the rotation on your calendar
Copy the token now. Vercel shows it only once.
2

Add the connection in CloudThinker

In the sidebar, click More → Workspace settings → Connections. On the Builtin Connections tab, search for Vercel, paste the token into VERCEL_TOKEN, and click Connect.Success state: the Vercel card in CloudThinker shows Connected. For Vercel, that means the token is saved, not that it works.
3

Run the verify prompt

Vercel accepts any token when the connection starts and only checks it on the first real call. A mistyped or expired token still shows Connected, so run the verify prompt before you rely on it.Success state: CloudThinker returns your Vercel user, teams, and projects. If it returns 403 Not authorized (invalidToken) instead, the token is bad: see Troubleshooting.

​
Connection details

​
Required permissions

Vercel tokens have no read-only option. The scope is your main control: a token scoped to one team can’t reach projects in any other team.
Scope the token to a single team and set an expiration. There’s no read-only mode for this connection. Choose Manual so a person approves every cancel, pause, and unpause — that is the control that works today.Once CloudThinker turns on Rule enforcement for your workspace, a Rule can narrow it. The quickest way is to ask for one in chat: /create-policy Deny cancelling deployments and pausing or unpausing projects on my Vercel connection refuses those controls outright, and /create-policy Ask first before cancelling deployments or pausing projects in production on my Vercel connection sends the production ones to a person.
Every change an agent makes goes through your workspace’s Approvals first. On the default Auto · Rules + AI · Ask me mode, AI judgment can let a safe change run without asking — and an Allow Rule can too, once CloudThinker turns on Rule enforcement for your workspace. Choose Manual to approve every change yourself.

​
Agent capabilities

Rollback suggestions are advice only. CloudThinker has no tool to roll back or redeploy on Vercel.

​
Verify the connection

​
Example prompts

Name the team or project in your prompt when the account has many projects. The answer comes back faster and stays focused.

​
Troubleshooting

To swap a token on an existing connection, open the connection, click the edit icon on the instance, click Replace… in Edit Instance, paste the new token, and click Save and test. See Rotate a credential.
The token is wrong, expired, or revoked. The connection still showed Connected because Vercel only checks the token on the first call. Create a new token and replace it on the connection.
Other requests work, but the token’s scope doesn’t include that team. Create a token scoped to the right team and replace it on the connection.
The name or ID is wrong, or it belongs to a team outside the token’s scope. Ask CloudThinker to list your projects first, then use a name from that list.
Controls go through your Approvals first, and CloudThinker never retries a refused request. A person may have rejected it on Manual. On Auto, your Approval mode may be set to Refuse when nothing allows the change. Once Rule enforcement is on, a Deny Rule can also refuse it outright. Ask again when you want it to run.

​
Security

  • Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
  • Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
  • Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
  • Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.
  • No read-only token: Vercel has no read-only credential, so the read-only advice above can’t apply here. Use a team-scoped token and choose Manual, so a person approves every change, plus a Deny or Ask first Rule once Rule enforcement is on.
  • Plan rotation: Vercel tokens don’t rotate on their own. Set an expiration when you create one and replace it before that date.
  • Watch runtime logs: an app can print secrets into its own logs. CloudThinker replaces credential-shaped values in tool output with a placeholder before the model or chat sees them (see Data protection), but a secret in an unusual format can slip through. Keep secrets out of logs at the source.

Approvals

Decide which Vercel controls run on their own and which wait for you

Connections overview

See every platform you can connect and how to rotate a credential